Healthcare's AI Governance Has No Evidence Layer

The policy phase is finished. Proof is not.

Clearwater’s new benchmark, drawn from 105 hospitals, health systems, physician and dental groups, health plans, and their technology vendors, lands on an uncomfortable number: 91% of healthcare organizations cannot verify their own AI governance is operating as intended (PR Newswire). Most have formed committees and written policies. Almost none can produce evidence that those policies govern anything in practice (BankInfoSecurity).

This is not a gap in ambition. It is a gap in instrumentation. Healthcare built the governance org chart before it built the telemetry to audit it, and Clearwater’s report frames this as the sector’s core cybersecurity exposure heading into 2026, not a side issue to security operations (Healthcare IT News). A model inventory that nobody reconciles against deployed systems is not governance under NIST AI RMF or ISO 42001. It is paperwork with a committee attached.

The timing compounds the problem. CMS-0057-F compresses prior authorization decisions to 72 hours for urgent requests and 7 calendar days for standard ones, with FHIR-based API requirements phasing in through 2027 (CareCloud). Health IT Answers has already flagged that the 2027 interoperability deadline is functionally a 2026 build problem, because the engineering and testing work has to land well before the compliance date (Health IT Answers). Health systems and payers are responding by pushing more AI into claims review, denial management, and appeals, exactly the workflows Clearwater finds least governed. Speed requirements and verification gaps are converging on the same systems at the same time.

Board-level oversight is not closing the gap either. A separate review of health system governance finds low continuing-education requirements for trustees, missing role descriptions, and no member evaluation process, with AI and consumer competency flagged as the area boards are least equipped to assess (Chief Healthcare Executive). Governance structures are being reorganized at the trustee level, as with Adena’s five-hospital system consolidating oversight across sites (Yahoo News), but structural change at the board is a different layer than operational verification at the model level. Both matter. Neither substitutes for the other.

The cost of this gap is not hypothetical. Oracle Health’s 2025 breach exposed Social Security numbers, addresses, and medical information for roughly 20 million people, nearly 3 million of them in Texas alone (Fierce Healthcare). That is the downside case for an environment where committees exist but nobody can confirm controls held.

For compliance and technology leaders, the decision in front of them is not whether to adopt AI governance frameworks. Most already have. It is whether their current program produces verifiable evidence, logs, model inventories reconciled to production, access controls tested against policy, or whether it produces minutes. ISO 42001 certification and NIST AI RMF profiles both demand the former. Clearwater’s data says the sector is still selling the latter to its own boards.

The committees are real. The proof is not yet. That distinction will define who passes an audit and who explains a breach.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The argument is coherent and well-structured—policy exists but evidence of enforcement does not—though the Oracle breach is presented as illustrating the cost of governance gaps without establishing t
Source & Claim Verification	Qwen · hosted fallback (qwen-2.5-72b-instruct)	cleared. All factual claims are traced to citations, but some sources are not directly relevant to the claims they support, which could be improved for clarity and precision.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects the evidence-layer requirements of ISO 42001, NIST AI RMF, and the EU AI Act, but does not explicitly map to CLIA, NERC CIP, or DO-178C frameworks.
Technical Accuracy	Llama	cleared. The article accurately describes the gap in AI governance instrumentation and verification in healthcare organizations, citing relevant sources and technical standards like NIST AI RMF and ISO 42001.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and counters potential vendor hype by focusing on the lack of verifiable evidence despite widespread policy adoption, though the primary source is a vendor report.
Novelty & Non-Duplication	Grok	held. Core 91% Clearwater finding and visibility/governance gap framing are straight wire rewrites of the PR Newswire/BankInfoSecurity pieces already out, with only light secondary stitching to CMS timeline
Validation	DeepSeek	cleared. The central claim that healthcare AI governance lacks an evidence layer is strongly validated by a cited benchmark finding 91% of organizations cannot verify their governance is operating as intended.

Sources cited: 41. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.